license_patrol 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4654e0d8c8444ded245bd4960a0897b7ec961ac6329751ae545cefbf907adbd2
-  data.tar.gz: c7b5677df462576bd56bc82f3114052cbd136afba270effcf19427d8621b5e9f
+  metadata.gz: bfadea16931d270ad27f48e5db7d22d95751c39335299a0375b037b192d88925
+  data.tar.gz: acba13bf06366eb312bde648d1aefc653576ff2fa67cae75a2cbddf9d697a84b
 SHA512:
-  metadata.gz: 01cd7fd00cacc1e8e150294fcdd43abc35261fe2da6e82138e5cc6a335d3503120df25ce0728888bd30cbabae39cd0c81df1c427a7c0b681ef2b4c97f2b8f5e3
-  data.tar.gz: aed4baf70fad953b9c6fdf6a851e5c1cb0dc6f501f115b9676771b7c82967fd1c40776b36635805961e24ce37896c128436939f80be9ac6acbcb930afa1d6652
+  metadata.gz: bd3c0356c36aa7aae5ed0891ce8e4b4baff329fdbbd21f26316f87f13d6de4daf9f4d3b6ed1831f4b1cbac9a7763f0224ef371d9cc2a87abf8ea67e760ad8a10
+  data.tar.gz: ba987bba63a5b6161407ad3fb73c904d15e6d4d2438cf6ce8cfea6e867dfb7435e8cfab1be6c7f2b3c2bb34bd19ff955de05155356d0cff3519c58863f7ac89d

data/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Managed by https://github.com/powerhome/software. Do not make changes here, they will be reverted.
+* @powerhome/heroes-for-hire

data/.github/workflows/stale.yml

@@ -0,0 +1,35 @@
+# Managed by https://github.com/powerhome/software. Do not make changes here, they will be reverted.
+
+name: 'Close stale issues and PRs'
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '37 21 * * *'
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          operations-per-run: 200
+          delete-branch: true
+          stale-pr-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity. It will be closed in 24 hours if no further activity occurs.
+
+            If this change is desirable, please accelerate completing it. If it is not,
+            please close the PR. If you're blocked on something, please ensure there's
+            a reference to this PR in a story on your team's board so the team will
+            follow up, and consider closing the PR for now.
+
+            Please do not artificially extend the deadline with a dummy comment. If
+            necessary, provide a status update, such as "this change is being actively
+            tested".
+
+            Thank you for your contributions and your collaboration in reducing WIP
+            and cycle time.
+          days-before-stale: 14
+          days-before-close: 3
+          days-before-issue-stale: -1
+          exempt-pr-labels: dependencies

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# [1.2.0] / 2026-10-28
+
+### Fixed
+* Yarn 2, 3 and 4 projects scan without the third-party licenses plugin, reading packages from the built-in `yarn info` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
+
+### Changed
+* Yarn 2+ no longer reports workspaces as packages, and `--prepare` only runs `yarn install` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
+
 # [1.1.0] / 2026-10-21
 
 ### Added

data/README.md

@@ -48,7 +48,7 @@ and give you an actionable exception report.
 * Objective-C, Swift (via Carthage, CocoaPods \[0.39 and below. See [CocoaPods Specs Repo Sharding](http://blog.cocoapods.org/Sharding/)\]) and Swift Package Manager(SPM)
 * Elixir (via `mix`)
 * Golang (via `gvt`, `glide`,`dep`, `trash` and `govendor`)
-* JavaScript (via `yarn`)
+* JavaScript (via `yarn` 1.x through 4.x)
 * C++/C (via `conan`)
 * Scala (via `sbt`)
 * Rust (via `cargo`)
@@ -328,7 +328,7 @@ be approved. The project name at the top of the report can be set with
 `license_patrol project_name add`.
 
 ### Note:
-When using the yarn package manager, when a node_module's package.json doesn't
+When using Yarn 1, when a node_module's package.json doesn't
 explicitly declare a license, yarn indicates that it has inferred the license based
 on some keywords in other files by appending an asterisk to the license name. If you
 see a * at the end of the license name, this is intended.

data/VERSION

@@ -1 +1 @@
-1.1.0
+1.2.0

data/lib/license_patrol/package_managers/yarn.rb

@@ -8,30 +8,17 @@ module LicensePatrol
     end
 
     SHELL_COMMAND = 'yarn licenses list --recursive --json'
+    BERRY_SHELL_COMMAND = 'yarn info --all --recursive --json --extra manifest'
 
     def possible_package_paths
       [project_path.join('yarn.lock')]
     end
 
     def current_packages
-      # the licenses plugin supports the classic production flag
-      cmd = "#{Yarn::SHELL_COMMAND}#{classic_yarn_production_flag}"
       if yarn_version == 1
-        cmd += ' --no-progress'
-        cmd += " --cwd #{project_path}" unless project_path.nil?
-        cmd += " #{@yarn_options}" unless @yarn_options.nil?
-      end
-
-      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
-      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
-
-      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
-      json_objects = json_strings.map { |json_object| JSON.parse(json_object) }
-
-      if yarn_version == 1
-        get_yarn1_packages(json_objects)
+        get_yarn1_packages(run_json_command(classic_shell_command))
       else
-        get_yarn_packages(json_objects)
+        get_yarn_packages(run_json_command(BERRY_SHELL_COMMAND))
       end
     end
 
@@ -62,20 +49,28 @@ module LicensePatrol
 
     private
 
+    # devDependencies are left out when reading the packages, so all of them are installed
     def yarn_prepare_command
-      "#{yarn_plugin_production_command}yarn install && yarn plugin import https://raw.githubusercontent.com/mhassan1/yarn-plugin-licenses/#{yarn_licenses_plugin_version}/bundles/@yarnpkg/plugin-licenses.js"
+      'yarn install'
     end
 
     def classic_yarn_prepare_command
       "yarn install --ignore-engines --ignore-scripts#{classic_yarn_production_flag}"
     end
 
-    def yarn_licenses_plugin_version
-      if yarn_version == 2
-        'v0.6.0'
-      else
-        'v0.7.2'
-      end
+    def classic_shell_command
+      cmd = "#{Yarn::SHELL_COMMAND}#{classic_yarn_production_flag} --no-progress"
+      cmd += " --cwd #{project_path}" unless project_path.nil?
+      cmd += " #{@yarn_options}" unless @yarn_options.nil?
+      cmd
+    end
+
+    def run_json_command(cmd)
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
+      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
+
+      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
+      json_strings.map { |json_object| JSON.parse(json_object) }
     end
 
     def yarn_version
@@ -88,40 +83,64 @@ module LicensePatrol
       end
     end
 
+    # Yarn 2+ prints one line per package in the lockfile, keyed by its locator
+    # (e.g. "@babel/core@npm:7.18.6"). Workspaces are the project's own code,
+    # so only the packages they depend on are reported.
     def get_yarn_packages(json_objects)
-      packages = []
-      incompatible_packages = []
-      json_objects.each do |json_object|
-        license = json_object['value']
-        body = json_object['children']
-
-        body.each do |package_name, vendor_info|
-          valid_match = %r{(?<name>@?[\w/.-]+)@(?<manager>\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s
-          valid_match = %r{(?<name>@?[\w/.-]+)@virtual:.+#(\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s if manager.eql?('virtual')
-
-          if valid_match
-            homepage = vendor_info['children']['vendorUrl']
-            author = vendor_info['children']['vendorName']
-            package = YarnPackage.new(
-              name,
-              version,
-              spec_licenses: [license],
-              homepage: homepage,
-              authors: author,
-              install_path: project_path.join(modules_folder, name)
-            )
-            packages << package
-          end
-
-          incompatible_match = %r{(?<name>@?[\w/.-]+)@[a-z]*:(?<version>(\.))} =~ package_name.to_s
-          if incompatible_match
-            package = YarnPackage.new(name, version, spec_licenses: [license])
-            incompatible_packages.push(package)
-          end
+      infos = json_objects.map { |json_object| [json_object['value'], json_object['children']] }.to_h
+      locators = ignore_dev_dependencies? ? production_locators(infos) : infos.keys
+
+      packages = locators.reject { |locator| workspace_locator?(locator) }.map do |locator|
+        name = locator_name(locator)
+        info = infos[locator]
+        manifest = info['Manifest'] || {}
+        YarnPackage.new(
+          name,
+          info['Version'],
+          spec_licenses: [manifest['License']].compact,
+          homepage: manifest['Homepage'],
+          install_path: project_path.join(modules_folder, name)
+        )
+      end
+
+      # a patched package (e.g. typescript) is listed next to the package it patches
+      packages.uniq { |package| [package.name, package.version] }
+    end
+
+    # Walks the dependencies of every workspace, skipping the ones they declare
+    # in devDependencies, like "yarn workspaces focus --all --production".
+    def production_locators(infos)
+      seen = Set.new
+      pending = infos.keys.select { |locator| workspace_locator?(locator) }
+      until pending.empty?
+        locator = devirtualize(pending.shift)
+        next unless infos.key?(locator) && seen.add?(locator)
+
+        dev_dependencies = workspace_locator?(locator) ? workspace_dev_dependencies(locator) : []
+        (infos[locator]['Dependencies'] || []).each do |dependency|
+          pending << dependency['locator'] unless dev_dependencies.include?(locator_name(dependency['descriptor']))
         end
       end
+      seen.to_a
+    end
 
-      packages + incompatible_packages.uniq
+    def workspace_dev_dependencies(locator)
+      workspace_path = locator.delete_prefix("#{locator_name(locator)}@workspace:")
+      manifest = JSON.parse(File.read(project_path.join(workspace_path, 'package.json')))
+      (manifest['devDependencies'] || {}).keys - (manifest['dependencies'] || {}).keys
+    end
+
+    def locator_name(locator)
+      locator[%r{\A(@[^/@]+/)?[^@]+}]
+    end
+
+    def workspace_locator?(locator)
+      locator.start_with?("#{locator_name(locator)}@workspace:")
+    end
+
+    # "react-dom@virtual:c6e8...#npm:18.2.0" is "react-dom@npm:18.2.0" with its peer dependencies resolved
+    def devirtualize(locator)
+      locator.sub(/@virtual:[^#]*#/, '@')
     end
 
     def get_yarn1_packages(json_objects)
@@ -181,15 +200,11 @@ module LicensePatrol
     end
 
     def classic_yarn_production_flag
-      return '' if @ignored_groups.nil?
-
-      @ignored_groups.include?('devDependencies') ? ' --production' : ''
+      ignore_dev_dependencies? ? ' --production' : ''
     end
 
-    def yarn_plugin_production_command
-      return '' if @ignored_groups.nil?
-
-      @ignored_groups.include?('devDependencies') ? 'yarn plugin import workspace-tools && yarn workspaces focus --all --production && ' : ''
+    def ignore_dev_dependencies?
+      !@ignored_groups.nil? && @ignored_groups.include?('devDependencies')
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_patrol
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Ryan Collins
@@ -396,9 +396,11 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".force-build"
+- ".github/CODEOWNERS"
 - ".github/dependabot.yml"
 - ".github/workflows/install-test-tools.sh"
 - ".github/workflows/license_patrol.yml"
+- ".github/workflows/stale.yml"
 - ".gitignore"
 - ".pre-commit-hooks.yaml"
 - ".rspec"